Function generate_token 

pub fn generate_token() -> String

Generate a fresh 32-byte token, hex-encoded. Public so tests and downstream code that mints tokens directly (e.g. server-rendered forms) share the same shape. Raw (unsigned) — the signed wrapper is applied by the middleware.